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NASA PERSONNEL/PAYHOLL SYSTEM i'NppSi BUDGET 


SITUATION 


STATUS 

• DEVELOPMENT PROBLEMS HAVE CAURFD 

- COST OVERRUN OF $1,2M 

- SCHEDULE STRETCHOUT uf y MON { HS 

• DEVELOPMENT OVERRUN 

- WILL BE FUNDED FROM NPPS MAINTENANCE FUNDS NO 
LONGER REQUIRED DUE TO SCHEDULE SLIP 

- HAS NOT IMPACTED OTHER AIM PROJECT FUNDING IN FY 1990 

CONCERNS 

• FUNDING LEVEL UNKNOWN FOR FY 1990 

• CAPPS PROJECT REMAINS SUSPENDED 

• FUNDING DELAYS/INTERVENTIONS CONTINUF TO RAP INORDINATE 
AMOUNTS OF ENERGY 

PLANS 

• CONTINUE IMPLEMENTATION OF JSC CORRECTIVE ACTION PLAN 

• EVALUATE AIM PROGRAM ASSESSMFNT BOARD RECOMMENDATIONS 
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l\J/\S/V LOGISTICS AND SECURITY OFFICE 

OFFICE OF MANAGEMENT 


NRP AT KSC 

BACKGROUND 

• ORIGINAL COST ESTIMATES FOR FY89 WERE UNDERESTIMATED: 

- SOME OF ORIGINAL COFF COSTS WERE CARRIED AS RSPM 

- UNABLE TO USE EXISTING EMERGENCY POWER SUBSTATION AS ORIGINALLY 
PLANNED 

- PRELIMINARY ENGINEERING REPORT (JUNE 9, 1989) REFLECTS INCREASED 
CCTV LIGHTING LEVEL REQUIREMENT 

-- INSTALLATION OF FENCING, GUARD HOUSES AND PERIMETER LIGHTING FOR 
PAD -A" NOT IN BUDGET WRITE-UPS 

CURRENT STATUS 

• FY89 8 FY90 COFF FUNDING ($4.2M) APPEARS SUFFICIENT FOR PADS "A” 8 "B" 

- HQ/KSC MEETING (SEPTEMBER 28. 1989) DESIGNATED PADS AS PRIORITY 

• DESIGN PHASE OF IMPLEMENTATION PLAN FOR PADS STARTED OCTOBER 1989 

• REMAINING PROJECTS IN JEOPARDY 

CONCERNS 

• REMAINING PROJECTS MUST BE DEFERRED 

• FUNDED PAD PROJECTS IN JEOPARDY FROM FY90 COFF BUDGET REDUCTIONS 

PLANS 

• KSC HAS SUBMITTED A FY92 COFF PROJECT FOR BALANCE OF THE WORK 
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FY 86 

FY B7 

FY 68 

FY 89 

FY 90 

FY 91 

CONVERSION 

TOTALS 

ORIGINAL PLAN 

NPPS 

DEVELOPMENT 

i i ,500 

$2,000 

$1.300 

SiJOU 

— 

— 

$5,600 

CENTER CONVERSION 

— 

— 

$1,200 

$1,200 

— 

_ 

$2,400 

MAINTENANCE 

— 

— 

— 

— 

$1.000 

$1,000 


CAPPS 

DEVELOPMENT 





$1,000 

$1,000 

$2,000 

$10,000 

AMOUNTS RECEIVED 

$1 500 

$2 000 

$1,247 1 

$2,000 

2 

nnn 
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CURRENT PLAN 4 - 5 

NPPS 







($300 

DEVcLOPMEN I 

$1,400 

$i,/0u 

4/4/ 

$2,064 

$679 

_ 

$6,590 AP * 

CENTER CONVERSION 

— 

$300 

— 

$522 

$1.000 

_ 

$1.822 

MAINTENANCE 

— 

— 

— 

_ 

$321 

$1,400 

_ 

CAPPS 

DEVELOPMENT 

$100 


$300 

$300 


$1,000 

$1,700 

$10,112 


1 $1,253 DIVERTED IN FY88 

2 ESTIMATED 

3 SHORTFALL PROVIDED FROM COOE NT RUCGET 


F ACTUALS THROUGH FT 89 
5 ASSUME $679 DIVERTED IN FY 90 IS RECOVERED 
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SPACE PHYSICS ANALYSIS NETWORK (SPAN1 
WORM INCIDENT 


BACKGROUND ON SPAN 

• CREATED IN 1981 FOR OPEN EXCHANGE OF SCIENTIFIC 
INFORMATION BY RESEARCHERS 

• COMPOSED OF INTERNATIONAL NETWORK OF APPROXIMATELY 
6,000 NODES SERVING APPROXIMATELY 100,000 USERS: 

- GOVERNMENT (APPROXIMATELY 600 NASA MANAGED) 

- PRIVATE INDUSTRY 

- UNIVERSITY 

• CAN BE ACCESSED FROM ALMOST ANYWHERE IN WORLD 
USING A PERSONAL COMPUTFR ANn TFI FPHONE 
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SPACE PHYSICS ANALYSIS NETWORK (SPAN) 
WORM INCIDENT 


DESCRIPTION OF ATTACK 

• ORIGIN TRACED TO FRANCE 

• WORM CODE: 

- EXPLOITS POOR PASSWORD MANAGEMENT PRACTICES 

- NASA VICTIMS FAILED TO FOLLOW PUBLISHED AGENCY POLICIES 
AND PROCEDURES 

- CAUSES 

- DISRUPTION AND DENIAL OF SERVICE 

- EXPENDITURE OF RESOURCES TO TECHNICALLY DIAGNOSE 
AND DISINFECT AFFECTED SYSTEMS 

- DISPLAY OF BANNER ON USER SCREENS 

• TWO PHASED ATTACK 

- OCT 16 ATTACK AFFECTED APPROXIMATELY 90 NODES 

- OCT 29 ATTACK AFFECTED OVER 500 NODES 

- USED IMPROVED VERSION TO EXPLOIT ADDITIONAL PASSWORDS 

• SPECIFIC IDENTIFICATION OF PENETRATED NODES UNDERWAY 

- ONLY 3 IDENTIFIED AT NASA TO DATE 

• ATTACK IS STILL ACTIVE 
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SPACE PHYSICS ANALYSIS NETWORK j SPAN) 
WORM INCIDENT 
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SPACE PHYSICS ANALYSIS NETWORK (SPAN) 
WORM INCIDENT 


EFFORTS TO REDUCE FUTURE RISK EXPOSURE 

• INSTRUCTIONS BEING REISSUED TO ALL NODE MANAGERS TO 
STRENGTHEN PASSWORD MANAGEMENT PRACTICES 

• SELECTED NETWORK NODES (NASA AND NON-NASA) WILL BE 
AUDITED TO ASSURE COMPLIANCE WITH PASSWORD MANAGEMENT 
INSTRUCTIONS 

• NASA/IG AND FBI ARE INVESTIGATING FOR PROSECUTION 

HOWEVER 

• OPEN INTERNATIONAL NETWORKS WILL ALWAYS HAVE A CERTAIN 
LEVEL OF VULNERABILITY 
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AFFIRMATIVE ACTION PROGRESS REPORT 
FISCAL YEAR 1990 



FY 1990-1992 ACTION PLAN/ 

COMMITMENT/TARGET TARGET/DATE 


• ESTABLISH OFFICE OF MANAGEMENT EQUALITY CIRCLE FIRST MEETING SCHEDULED 

DECEMBERS, 1989 

• SEPERATE EQUAL OPPORTUNITY AND MULTI-CULTURAL 
EDUCATION PROGRAM TRAINING FOR ALL 
EMPLOYEES 

• AVERAGE 1 PROFESSIONAL DEVELOPMENT TRAINING 
INCIDENT PER EMPLOYEE PER YEAR 

• DEVELOP CAREER COMPETENCY DEVELOPMENT 
PROGRAM PILOT PROJECT 

• MEET OR EXCEED 20% MINORITY MALE AND FEMALE 
PROFESSIONAL WORKFORCE (FTE, CO-OP, AND PMI) 

REPRESENTATION GOAL ESTABLISHED AS A RESULT 
OF THE MEAN AGREEMENT 

• INCREASE NUMBER OF MINORITY FEMALE EMPLOYEES 
AT OR ABOVE GS-14 FROM 0 TO 3 


V_ J 


HAVE REQUESTED PROGRAM 
— DEVELOPMENT DISCUSSIONS WITH 
CODE DP TO START BY EARLY 
DECEMBER 1989 


— DEVELOP PROACTIVE CODE N 
STRATEGY FOR MINORITY 
RECRUITMENT BY JANUA ,Y 31, 1990 
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